# CVEs published 2019-04-26

58 CVEs were published on April 26, 2019: 0 critical, 10 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2019-11557](https://cve.now/CVE-2019-11557.md): The WebDorado Contact Form Builder plugin before 1.0.69 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with res (no CVSS)
- [CVE-2019-11555](https://cve.now/CVE-2019-11555.md): The EAP-pwd implementation in hostapd (EAP server) before 2.8 and wpa\_supplicant (EAP peer) before 2.8 does not validate fragmentation reass (no CVSS)
- [CVE-2019-3843](https://cve.now/CVE-2019-3843.md): It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID binary that would be allowed to run as the tr (CVSS 4.5, \[freedesktop.org\] systemd)
- [CVE-2019-3844](https://cve.now/CVE-2019-3844.md): It was discovered that a systemd service that uses DynamicUser property can get new privileges through the execution of SUID binaries, which (CVSS 4.5, \[freedesktop.org\] systemd)
- [CVE-2019-7476](https://cve.now/CVE-2019-7476.md): A vulnerability in SonicWall Global Management System (GMS), allow a remote user to gain access to the appliance using existing SSH key. (no CVSS, SonicWall Global Management System)
- [CVE-2019-11533](https://cve.now/CVE-2019-11533.md): Cross-site scripting (XSS) vulnerability in ProjectSend before r1070 allows remote attackers to inject arbitrary web script or HTML. (no CVSS)
- [CVE-2019-11492](https://cve.now/CVE-2019-11492.md): ProjectSend before r1070 writes user passwords to the server logs. (no CVSS)
- [CVE-2018-18276](https://cve.now/CVE-2018-18276.md): XSS exists in the ProFiles 1.5 component for Joomla! via the name or path parameter when creating a new folder in the administrative panel. (no CVSS)
- [CVE-2018-15582](https://cve.now/CVE-2018-15582.md): Cross-Site Scripting (XSS) vulnerability in adm/sms\_admin/num\_book\_write.php and adm/sms\_admin/num\_book\_update.php in gnuboard5 before 5.3.1 (no CVSS)
- [CVE-2018-15580](https://cve.now/CVE-2018-15580.md): Cross-Site Scripting (XSS) vulnerability in adm/contentformupdate.php in gnuboard5 before 5.3.1.6 allows remote attackers to inject arbitrar (no CVSS)
- [CVE-2018-15584](https://cve.now/CVE-2018-15584.md): Cross-Site Scripting (XSS) vulnerability in adm/boardgroup\_form\_update.php and adm/boardgroup\_list\_update.php in gnuboard5 before 5.3.1.6 al (no CVSS)
- [CVE-2018-15581](https://cve.now/CVE-2018-15581.md): Cross-Site Scripting (XSS) vulnerability in adm/faqmasterformupdate.php in gnuboard5 before 5.3.1.6 allows remote attackers to inject arbitr (no CVSS)
- [CVE-2019-11220](https://cve.now/CVE-2019-11220.md): An authentication flaw in Shenzhen Yunni Technology iLnkP2P allows remote attackers to actively intercept user-to-device traffic in cleartex (no CVSS)
- [CVE-2019-11219](https://cve.now/CVE-2019-11219.md): The algorithm used to generate device IDs (UIDs) for devices that utilize Shenzhen Yunni Technology iLnkP2P suffers from a predictability fl (no CVSS)
- [CVE-2019-6689](https://cve.now/CVE-2019-6689.md): An issue was discovered in Dillon Kane Tidal Workload Automation Agent 3.2.0.5 (formerly known as Cisco Workload Automation or CWA). (no CVSS)
- [CVE-2019-3707](https://cve.now/CVE-2019-3707.md): WS-MAN Authentication Bypass Vulnerability (CVSS 8.6, Dell EMC iDRAC)
- [CVE-2019-3706](https://cve.now/CVE-2019-3706.md): Web Interface Authentication Bypass Vulnerability (CVSS 8.6, Dell EMC iDRAC)
- [CVE-2019-3705](https://cve.now/CVE-2019-3705.md): Buffer Overflow Vulnerability (CVSS 8.1, Dell EMC iDRAC)
- [CVE-2019-2725](https://cve.now/CVE-2019-2725.md): Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). (CVSS 7.5, KEV, Oracle Tape Library ACSLS)
- [CVE-2019-9806](https://cve.now/CVE-2019-9806.md): A vulnerability exists during authorization prompting for FTP transaction where successive modal prompts are displayed and cannot be immedia (no CVSS, Mozilla Firefox)
- [CVE-2018-18509](https://cve.now/CVE-2018-18509.md): A flaw during verification of certain S/MIME signatures causes emails to be shown in Thunderbird as having a valid digital signature, even i (no CVSS, Mozilla Thunderbird)
- [CVE-2018-18510](https://cve.now/CVE-2018-18510.md): The about:crashcontent and about:crashparent pages can be triggered by web content. (no CVSS, Mozilla Firefox)
- [CVE-2018-18511](https://cve.now/CVE-2018-18511.md): Cross-origin images can be read from a canvas element in violation of the same-origin policy using the transferFromImageBitmap method. (no CVSS, Mozilla Firefox)
- [CVE-2018-18512](https://cve.now/CVE-2018-18512.md): A use-after-free vulnerability can occur while playing a sound notification in Thunderbird. (no CVSS, Mozilla Thunderbird)
- [CVE-2018-18513](https://cve.now/CVE-2018-18513.md): A crash can occur when processing a crafted S/MIME message or an XPI package containing a crafted signature. (no CVSS, Mozilla Thunderbird)
- [CVE-2019-9788](https://cve.now/CVE-2019-9788.md): Mozilla developers and community members reported memory safety bugs present in Firefox 65, Firefox ESR 60.5, and Thunderbird 60.5. (no CVSS, Mozilla Thunderbird · Mozilla Firefox ESR +1)
- [CVE-2019-9789](https://cve.now/CVE-2019-9789.md): Mozilla developers and community members reported memory safety bugs present in Firefox 65. (no CVSS, Mozilla Firefox)
- [CVE-2019-9790](https://cve.now/CVE-2019-9790.md): A use-after-free vulnerability can occur when a raw pointer to a DOM element on a page is obtained using JavaScript and the element is then (no CVSS, Mozilla Thunderbird · Mozilla Firefox ESR +1)
- [CVE-2019-9791](https://cve.now/CVE-2019-9791.md): The type inference system allows the compilation of functions that can cause type confusions between arbitrary objects when compiled through (no CVSS, Mozilla Thunderbird · Mozilla Firefox ESR +1)
- [CVE-2019-9792](https://cve.now/CVE-2019-9792.md): The IonMonkey just-in-time (JIT) compiler can leak an internal JS\_OPTIMIZED\_OUT magic value to the running script during a bailout. (no CVSS, Mozilla Thunderbird · Mozilla Firefox ESR +1)
- [CVE-2019-9793](https://cve.now/CVE-2019-9793.md): A mechanism was discovered that removes some bounds checking for string, array, or typed array accesses if Spectre mitigations have been dis (no CVSS, Mozilla Thunderbird · Mozilla Firefox ESR +1)
- [CVE-2019-9794](https://cve.now/CVE-2019-9794.md): A vulnerability was discovered where specific command line arguments are not properly discarded during Firefox invocation as a shell handler (no CVSS, Mozilla Thunderbird · Mozilla Firefox ESR +1)
- [CVE-2019-9795](https://cve.now/CVE-2019-9795.md): A vulnerability where type-confusion in the IonMonkey just-in-time (JIT) compiler could potentially be used by malicious JavaScript to trigg (no CVSS, Mozilla Thunderbird · Mozilla Firefox ESR +1)
- [CVE-2019-9796](https://cve.now/CVE-2019-9796.md): A use-after-free vulnerability can occur when the SMIL animation controller incorrectly registers with the refresh driver twice when only a (no CVSS, Mozilla Thunderbird · Mozilla Firefox ESR +1)
- [CVE-2019-9797](https://cve.now/CVE-2019-9797.md): Cross-origin images can be read in violation of the same-origin policy by exporting an image after using createImageBitmap to read the image (no CVSS, Mozilla Firefox)
- [CVE-2019-9798](https://cve.now/CVE-2019-9798.md): On Android systems, Firefox can load a library from APITRACE\_LIB, which is writable by all users and applications. (no CVSS, Mozilla Firefox)
- [CVE-2019-9799](https://cve.now/CVE-2019-9799.md): Insufficient bounds checking of data during inter-process communication might allow a compromised content process to be able to read memory (no CVSS, Mozilla Firefox)
- [CVE-2019-9801](https://cve.now/CVE-2019-9801.md): Firefox will accept any registered Program ID as an external protocol handler and offer to launch this local application when given a matchi (no CVSS, Mozilla Thunderbird · Mozilla Firefox ESR +1)
- [CVE-2019-9802](https://cve.now/CVE-2019-9802.md): If a Sandbox content process is compromised, it can initiate an FTP download which will then use a child process to render the downloaded da (no CVSS, Mozilla Firefox)
- [CVE-2019-9803](https://cve.now/CVE-2019-9803.md): The Upgrade-Insecure-Requests (UIR) specification states that if UIR is enabled through Content Security Policy (CSP), navigation to a same- (no CVSS, Mozilla Firefox)
- [CVE-2019-9804](https://cve.now/CVE-2019-9804.md): In Firefox Developer Tools it is possible that pasting the result of the 'Copy as cURL' command into a command shell on macOS will cause the (no CVSS, Mozilla Firefox)
- [CVE-2019-9805](https://cve.now/CVE-2019-9805.md): A latent vulnerability exists in the Prio library where data may be read from uninitialized memory for some functions, leading to potential (no CVSS, Mozilla Firefox)
- [CVE-2019-9807](https://cve.now/CVE-2019-9807.md): When arbitrary text is sent over an FTP connection and a page reload is initiated, it is possible to create a modal alert message with this (no CVSS, Mozilla Firefox)
- [CVE-2019-9808](https://cve.now/CVE-2019-9808.md): If WebRTC permission is requested from documents with data: or blob: URLs, the permission notifications do not properly display the originat (no CVSS, Mozilla Firefox)
- [CVE-2019-9809](https://cve.now/CVE-2019-9809.md): If the source for resources on a page is through an FTP connection, it is possible to trigger a series of modal alert messages for these res (no CVSS, Mozilla Firefox)
- [CVE-2019-9810](https://cve.now/CVE-2019-9810.md): Incorrect alias information in IonMonkey JIT compiler for Array.prototype.slice method may lead to missing bounds check and a buffer overflo (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2019-9813](https://cve.now/CVE-2019-9813.md): Incorrect handling of \_\_proto\_\_ mutations may lead to type confusion in IonMonkey JIT code and can be leveraged for arbitrary memory read an (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2018-5124](https://cve.now/CVE-2018-5124.md): Unsanitized output in the browser UI leaves HTML tags in place and can result in arbitrary code execution in Firefox before version 58.0.1. (no CVSS, Firefox)
- [CVE-2019-0186](https://cve.now/CVE-2019-0186.md): The input fields of the Apache Pluto "Chat Room" demo portlet 3.0.0 and 3.0.1 are vulnerable to Cross-Site Scripting (XSS) attacks. (no CVSS, Apache Software Foundation Apache Pluto · org.apache.portal…)
- [CVE-2015-9284](https://cve.now/CVE-2015-9284.md): The request phase of the OmniAuth Ruby gem (1.9.1 and earlier) is vulnerable to Cross-Site Request Forgery when used as part of the Ruby on (no CVSS, omniauth ruby gem · omniauth)
- [CVE-2018-5179](https://cve.now/CVE-2018-5179.md): A service worker can send the activate event on itself periodically which allows it to run perpetually, allowing it to monitor activity by u (no CVSS, Firefox)
- [CVE-2019-11493](https://cve.now/CVE-2019-11493.md): VeryPDF 4.1 has a Memory Overflow leading to Code Execution because pdfocx!CxImageTIF::operator in pdfocx.ocx (used by pdfeditor.exe and pdf (no CVSS)
- [CVE-2019-11543](https://cve.now/CVE-2019-11543.md): XSS exists in the admin web console in Pulse Secure Pulse Connect Secure (PCS) 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, and 8.1RX before (CVSS 8.3)
- [CVE-2019-11542](https://cve.now/CVE-2019-11542.md): In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 an (CVSS 8.0)
- [CVE-2019-11541](https://cve.now/CVE-2019-11541.md): In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, and 8.2RX before 8.2R12.1, users using SAML authent (CVSS 8.3)
- [CVE-2019-11540](https://cve.now/CVE-2019-11540.md): In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4 and 8.3RX before 8.3R7.1 and Pulse Policy Secure version 9.0RX before 9.0R (CVSS 8.3)
- [CVE-2019-11539](https://cve.now/CVE-2019-11539.md): In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 an (CVSS 8.0, KEV)
- [CVE-2019-11538](https://cve.now/CVE-2019-11538.md): In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1, a (CVSS 7.7)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-04-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.